[Warning] Detected Fake Anti-Virus SWs (Mac Defender, Mac Security, Mac Protector) based on MAC OS

1. Introduction

Various fake anti-virus SWs are emerged on Mac OS.
In these cases of anti-virus SWs, these SWs were spread all over the world, at the same time, apple products are big trend in Korea these days.
Therefore, users who are using devices adopted Mac OS need special attention to avoid those fake anti-virus SWs.

[MacDefender fake AV security software tops Apple Mac user woes]
http://www.computerweekly.com/Articles/2011/05/20/246730/MacDefender-fake-AV-security-software-tops-Apple-Mac-user.htm

[Mac users hit with fake anti-virus when using Google image search]
http://nakedsecurity.sophos.com/2011/05/02/mac-users-hit-with-fake-av-when-using-google-image-search/

One of german community site : http://macdefender.org/
This fake anti-virus SW has the same name as one of German community site. Hence that site noticed that the site has no relationship with that malicious software.

2. Spreading path and symptoms of infection

This anti-virus SW can be spread with not only Search Engine Optimization techniques but attached file and shorten URL of SNS or instant messenger. In Mac OS, this package can be installed as soon as finished download.

After the download is completed, it will show package installation pages, and can ask password for acquiring administrator permission.



After the installation is completed, fake anti-virus SW will scan like as following.



To click “Cleanup” button, you can see the register page.

To click "Register" button, it shows the form to pay as same as other malicious applications.



Needless to say that, the result is untruth.

* This fake anti-virus SWs may contain following packages..

- macprotector.pkg
- macProtectorInstallerProgramPostflight.pkg
- macsecurity.pkg
- macSecurityInstallerPostflight.pkg
- MacDefender.mpkg
- macdefenderSetupPostflight.pkg

3. How to prevent

Even if anti-virus SWs for Mac OS is not so prevalent, to keep safe Mac OS, installing anti-virus SW is necessary.

※ INCA Internet (Security Response Center / Emergency Response Team) provides diagnosis/treatment function such as malicious file stated above and runs responding system against various security threats.